corsaro_main.c

Go to the documentation of this file.

/* 
 * corsaro
 *
 * Alistair King, CAIDA, UC San Diego
 * corsaro-info@caida.org
 * 
 * Copyright (C) 2012 The Regents of the University of California.
 * 
 * This file is part of corsaro.
 *
 * corsaro is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * corsaro is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with corsaro.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include "config.h"

#include <getopt.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "libtrace.h"

#include "utils.h"

#include "corsaro.h"
#include "corsaro_log.h"

volatile sig_atomic_t corsaro_shutdown = 0;

static libtrace_t *trace = NULL;
static libtrace_packet_t *packet = NULL;
static libtrace_filter_t *filter = NULL;
static corsaro_t *corsaro = NULL;

static void catch_sigint(int sig)
{
  fprintf(stderr, "caught SIGINT, shutting down at the next opportunity\n");
  corsaro_shutdown = 1;
  signal(sig, catch_sigint);
}

static void clean()
{

  if(packet != NULL)
    {
      trace_destroy_packet(packet);
      packet = NULL;
    }

  if(corsaro != NULL)
    {
      corsaro_finalize_output(corsaro);
    }
}

static int init_trace(char *tracefile)
{
  trace = trace_create(tracefile);

  if (trace_is_err(trace)) {
    trace_perror(trace,"Opening trace file");
    clean();
    return -1;
  }

  if (trace_start(trace) == -1) {
    trace_perror(trace,"Starting trace");
    clean();
    return -1;
  }

  return 0;
}

static void close_trace()
{
  if(trace != NULL)
    {
      trace_destroy(trace);
      trace = NULL;
    }
}

static void usage(const char *name)
{
  fprintf(stderr, 
          "usage: %s -o outfile [-i interval] [-m mode] [-n name]\n"
          "          [-p plugin] [-f filter] trace_uri [trace_uri...]\n"
          "       -o <outfile>  use <outfile> as a template for file names.\n"
          "                      %%P will be replaced with the plugin name\n"
          "       -i <interval> distribution interval in seconds (default: %d)\n" 
          "       -m <mode>     output in 'ascii' or 'binary'. (default: ascii)\n"
          "       -n <name>     monitor name (default: "
          STR(CORSARO_MONITOR_NAME)")\n"
          "       -p <plugin>   enable the given plugin, -p can be used \n"
          "                      multiple times (default: all)\n"
          "       -f <filter>   BPF filter to apply to packets\n",
          name, CORSARO_INTERVAL_DEFAULT);
}

int main(int argc, char *argv[])
{       
  int opt;
  char *tmpl = NULL;
  char *name = NULL;
  char *bpf_filter = NULL;
  int i = -1000;
  int mode = CORSARO_FILE_MODE_DEFAULT;
  char *plugins[CORSARO_PLUGIN_ID_MAX];
  int plugin_cnt = 0;
  int tracefile_cnt = 0;
  char *traceuri = "Multiple Traces";

  signal(SIGINT, catch_sigint);

  while((opt = getopt(argc, argv, "f:i:m:n:o:p:v?")) >= 0)
    {
      switch(opt)
        {
        case 'i':
          i = atoi(optarg);
          break;

        case 'm':
          if(strcmp(optarg, "ascii") == 0)
            {
              /* ascii output format */
              mode = CORSARO_FILE_MODE_ASCII;
            }
          else if(strcmp(optarg, "binary") == 0)
            {
              mode = CORSARO_FILE_MODE_BINARY;
            }
          else
            {
              fprintf(stderr, 
                      "ERROR: mode parameter must be 'ascii' or 'binary'\n");
              usage(argv[0]);
              exit(-1);
            }
          break;

        case 'n':
          name = strdup(optarg);
          break;

        case 'o':
          /*
          if(strstr(optarg, CORSARO_PLUGIN_OUTPUT_PATTERN) == NULL)
            {
              fprintf(stderr,
                      "ERROR: template string must contain %s",
                      CORSARO_PLUGIN_OUTPUT_PATTERN);
              usage(argv[0]);
              exit(-1);
              } */
          tmpl = strdup(optarg);
          break;

        case 'p':
          plugins[plugin_cnt++] = strdup(optarg);
          break;

        case 'f':
          bpf_filter = strdup(optarg);
          break;

        case '?':
        case 'v':
          fprintf(stderr, "corsaro version %d.%d.%d\n", CORSARO_MAJOR_VERSION, 
                  CORSARO_MID_VERSION, CORSARO_MINOR_VERSION);
          usage(argv[0]);
          exit(0);
          break;

        default:
          usage(argv[0]);
          exit(-1);
        }
    }

  if(optind > argc - 1)
    {
      usage(argv[0]);
      exit(-1);
    }

  tracefile_cnt = argc-optind;

  /* create a packet buffer */
  if ((packet = trace_create_packet()) == NULL) {
    perror("Creating libtrace packet");
    clean();
    return -1;
  }

  /* argv[optind] is the pcap file */   
  /* only init the trace now if only one trace file */
  if(tracefile_cnt == 1)
    {
      if(init_trace(argv[optind]) != 0)
        {
          fprintf(stderr, "failed to init trace");
          clean();
          return -1;
        }
      traceuri = argv[optind];
    }

  /* create the bpf filter if specified */
  if(bpf_filter != NULL)
    {
      filter = trace_create_filter(bpf_filter);
    }

  if((corsaro = corsaro_alloc_output(tmpl, mode)) == NULL)
    {
      usage(argv[0]);
      clean();
      return -1;
    }

  /* keep a record of what this file was called */
  if(corsaro_set_traceuri(corsaro, traceuri) != 0)
    {
      corsaro_log(__func__, corsaro, "failed to set trace uri");
      clean();
      return -1;
    }

  if(name != NULL && corsaro_set_monitorname(corsaro, name) != 0)
    {
      corsaro_log(__func__, corsaro, "failed to set monitor name");
      clean();
      return -1;
    }

  if(i > -1000)
    {
      corsaro_set_interval(corsaro, i);
    }

  for(i=0;i<plugin_cnt;i++)
    {
      if(corsaro_enable_plugin(corsaro, plugins[i]) != 0)
        {
          corsaro_log(__func__, corsaro, "failed to enable %s",
                      plugins[i]);
          clean();
          return -1;
        }
    }

  if(corsaro_start_output(corsaro) != 0)
    {
      corsaro_log(__func__, corsaro, "failed to start corsaro");
      clean();
      return -1;
    }

  for(i = optind; i < argc; i++)
    {
      if(trace == NULL)
        {
          corsaro_log(__func__, corsaro, "processing %s", argv[i]);
          init_trace(argv[i]);
        }

      while (corsaro_shutdown == 0 && trace_read_packet(trace,packet)>0) {
        if((filter == NULL || trace_apply_filter(filter, packet) > 0) &&
           corsaro_per_packet(corsaro, packet) != 0)
          {
            corsaro_log(__func__, corsaro, "corsaro_per_packet failed");
            clean();
            return -1;
          }
      }
      
      if (trace_is_err(trace)) {
        trace_perror(trace,"Reading packets");
        corsaro_log(__func__, corsaro, "libtrace had an error reading packets");
        clean();
        return 1;
      }

      close_trace();
    }

  for(i=0;i<plugin_cnt;i++)
    {
      if(plugins[i] != NULL)
        free(plugins[i]);
    }
  
  if(tmpl != NULL)
    free(tmpl);

  return corsaro_finalize_output(corsaro);
}